New Admin account activity seen which was not seen historically

This will help you discover any new admin account activity which was seen and were not seen historically. Any new accounts seen in the results can be validated and investigated for any suspicious activities.

Detection logic

Detection requirements

Platform: Containers ESXi IaaS Identity Provider Linux macOS Network Devices Office Suite SaaS Windows
The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.
Log source product: office365
Log source service: officeactivity_exchange

Detection rules

New Admin account activity seen which was not seen historically

Detection logic

Detection requirements

MITRE ATT&CK mappings

From the source

Licence

Authorship

Detection rules